In xanadu Advanced Risk assessment, in case of no mitigating controls to assess, I expect that the residual risk calculation will not account for any reduction in risk due to controls, effectively treating the residual risk as equal to the inherent risk. My implementation is NOT calculating as expected.
Is my expectation correct? If so, what can be the root cause?
